CVE-2025-24865

The vulnerability results from the lack of an authentication mechanism (CWE-306 — Missing Authentication for Critical Function) in the administrative web interface of the application. An attacker remotely, without any credentials, can gain direct access to the administrative functions of the system. No user interaction or special network conditions are required — network access to the interface is sufficient.

An attacker can read sensitive system information and upload arbitrary files to the server without knowing the password, which may lead to complete takeover of the SCADA system and pose a threat to industrial infrastructure.

Patches available from the manufacturer should be applied according to the references. Update available at the manufacturer's address: https://www.myscada.org/downloads/mySCADAPROManager/. Until the patch is implemented, it is recommended to restrict network access to the administrative interface only to trusted IP addresses and isolate the system from public networks using a firewall.

mySCADA myPRO Manager product — versions specified in the manufacturer's references and in the CISA ICS-CERT advisory (ICSA-25-044-16)